Kochava Location Data Order: What the FTC Record Shows

Correction — October 2, 2026: The earlier version gave an unsupported May 15 final-order date and 10-year duration, and overstated the treatment of non-sensitive location data. We replaced those statements with the official case timeline and court document. The Verified Timeline The FTC sued Kochava in August 2022 over alleged sales of precise location information that could reveal visits to sensitive places. Its case page lists a proposed settlement order on May 4, 2026, and a stipulated court order on June 26, 2026. The linked court document was filed June 25. The court document says the defendants neither admit nor deny the complaint's allegations, apart from specified jurisdictional facts. A settlement and an allegation should not be described as a finding proving every disputed claim. What the Restrictions Cover The FTC announcement covers Kochava and its subsidiary Collective Data Solutions, which took over the data broker business. The sensitive-location restriction has a limited exception requiring a direct relationship with the consumer, affirmative express consent, and use for a service the consumer directly requested. The announcement also describes a sensitive-location program, supplier assessments, incident reporting, recipient information or deletion processes, consent withdrawal, and a retention schedule. Consult the linked order for the full requirements and defined exceptions. The supplier assessment obligations address consent for supplier-provided location data. It is inaccurate to summarize the order as simply allowing unrestricted sales of all non-sensitive location data. What This Means for Your Phone Review app location permissions and remove access that the app does not need. If your operating system offers approximate location, use that where precise coordinates are unnecessary. Review the app's privacy notice to understand sharing beyond its immediate function. A VPN changes how network traffic reaches the internet. It does not remove GPS coordinates from an app's data or override the location permissions you granted. Changing an advertising identifier also does not erase existing broker records. The order binds the named defendants. It does not by itself establish a universal rule for every broker or prove that all copies of previously collected data have disappeared. For practical next steps, start with the data broker opt-out guide and verify current instructions with the provider or regulator.